Re: ENRICHED log_format not encoding all parameters
On Thursday, July 20, 2017 4:06:48 AM EDT Peter KRIVANSKY wrote:
Hello together,
I am writing to this mailing list as I have not found any working solution
online.
We use the audit with ENRICHED log_format, but we see lots of
parameters not being decoded from HEX, Here are the auditd settings:
The decoding from hex is done by ausearch. Its always been like that. What the
enriched format does is capture the ephemeral system specific mappings such as
UID/GID at the moment the event occurs. This way the events can be correctly
displayed by ausearch no matter which computer you run ausearch on.
log_file = /var/log/audit/audit.log
log_format = ENRICHED
log_group = root
priority_boost = 4
flush = incremental
freq = 6000
num_logs = 10
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = hostname
max_log_file = 30
max_log_file_action = ROTATE
space_left = 150
space_left_action = SYSLOG
action_mail_acct = root
admin_space_left = 100
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
tcp_listen_queue = 5
tcp_max_per_addr = 1
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd
Installed audit Version:
2.6.5-3.el7_3.1
Here the problem parts of the Audit log (parameter a2):
node=hostname.domain.tld type=EXECVE msg=audit(1500536092.301:232170298):
argc=3 a0="/bin/sh" a1="-c"
a2=2F7573722F6C6F63616C2F6E6167696F732F6C6962657865632F636865636B5F6E727065
202D32202D482031302E3130302E3135302E313732202D702035363636202D6320436865636B
46696C6573202D74203230202D6120706174683D463A2F636C656172696E672F6D6366742F70
6F736569646F6E2F206D61782D6469722D64657074683D30207061747465726E3D2A33335F30
3535305F4C5F2A2E434B38202266696C7465723D7772697474656E206C74202D33306D20414E
442073697A652067742031306222204D6178437269743D31
not decoded parameter (a14) in the middle:
node= hostname.domain.tld type=EXECVE msg=audit(1500536092.303:232170300):
argc=16 a0="/usr/local/nagios/libexec/check_nrpe" a1="-2"
a2="-H"
a3="10.100.0.0" a4="-p" a5="5666" a6="-c"
a7="CheckFiles" a8="-t" a9="20"
a10="-a" a11="path=F:/clearing/mcft/poseidon/"
a12="max-dir-depth=0"
a13="pattern=*33_0550_L_*.CK8"
a14=66696C7465723D7772697474656E206C74202D33306D20414E442073697A65206774203
13062 a15="MaxCrit=1"
We need ENRICHED log_formad so we can analyze audit logs on a central Log
server. I tried to increase the „priority_boost“ parameter to 6, and
increased the „freq“ param. to 6000 to give the auditd more time for
decoding.
It doesn't need more time as this does not any kind of deadline scheduler. I
would however recommend using incremental_async for the flush method as its
about 90x faster than the normal incremental method. But this won't affect the
hex encoding. To see your event in full, you need to run the event through
ausearch.
None of the mentioned helped. What I don’t understand is that
sometimes it’s the last parameters which is not decoded, and sometimes it
one in the middle.
The hex encoding is done whenever there is a field being captured that could
be controlled by the user. This is to prevent someone naming a file that would
confuse a naive parser and make it misparse the event.
See example above
Any kind of advice is welcome
With kind regards
Hope this helps...
-Steve